You are trusting us with your source code, your customers’ data, and the credentials that connect them. This page describes what we actually do about that — including the parts still in progress.
Encryption
Every public endpoint terminates TLS at our edge. Older protocols (SSLv3, TLS 1.0, TLS 1.1) are disabled. Plain HTTP redirects to HTTPS on every hostname we serve, including customer sites. Certificates are issued and renewed automatically, with a weekly canary that alerts us if a renewal path breaks — because a silent renewal failure on our wildcard would take every customer site down at once.
Your environment variables, database credentials, OAuth tokens and two-factor secrets are encrypted with AES-256-GCM using a unique random initialization vector per value. Each ciphertext is cryptographically bound to the record it belongs to, so an encrypted value cannot be moved between records — even by something with direct database write access.
When the assistant sets an environment variable, the plaintext is stripped before the interaction is stored. Decryption events are recorded by key name only, never by value. We scan generated projects for credentials accidentally hardcoded into source and surface them to you.
Account passwords are hashed with bcrypt and cannot be read by us or by anyone with database access. Generated API keys and recovery codes are stored only as SHA-256 hashes — shown to you once, never again.
Access control
Time-based one-time passwords (TOTP), compatible with any authenticator app, with single-use recovery codes. Each code works exactly once rather than for the remainder of its time window. Changing or removing your second factor requires your password, so a stolen session cannot be used to lock you out of your own account.
Every sign-in creates a session you can see and end. Revoking one takes effect on the next request — not whenever the token happens to expire. Signing out ends the session for real, and enabling two-factor authentication ends every other session on the account.
SAML 2.0 and OIDC single sign-on, with SCIM provisioning so that removing someone from your identity provider removes their CoDuck access automatically. In active development — talk to us if you need a date.
Teams have owner, admin, editor and viewer roles, plus custom roles built from a fixed permission catalogue. Custom roles deliberately cannot carry the permissions that would let them promote themselves. Per-member monthly spend limits are supported.
Sign-ins, two-factor changes, session revocations, membership and role changes, and secret access are recorded to an append-only trail. You can review your own account's history; team admins can review their team's.
Your data
Each deployed application runs in its own container with dedicated CPU, memory and process limits, as a non-root user, against its own database with its own credentials. Connection rights are revoked by default and granted only to that project.
Generation runs against commercial model APIs under agreements that exclude training on your data. We do not sell or share your source code, and we do not use it to train anything of our own.
Analytics, error data and generation history are pruned automatically on defined schedules. Aggregated summaries are kept as the long-term record; raw detail is not kept indefinitely.
If you cancel, your sites stay live through your paid period plus a 30-day grace window, then sleep — the container stops, but nothing is deleted. Your data is retained and exportable, and resubscribing brings everything back exactly as it was.
Compliance
We are not SOC 2 certified yet. We are a small engineering-led company and we would rather tell you that directly than let you find out three weeks into a procurement review. What we do have: a documented security posture, reviewed changes with separate staging and production environments, automated dependency and secret scanning, and a written remediation plan for the gaps we know about.
For an enterprise review we will share a detailed security pack covering our architecture, subprocessors, data handling, and our current open findings with the plan and timeline for each. Ask and we will send it.
Email security@coduck.ai with enough detail to reproduce it. We acknowledge reports within two business days and will keep you updated until it is fixed. Please test against your own account and projects, and don’t access data belonging to anyone else — do that and we won’t pursue you for reporting in good faith.